The NIST Privacy Framework will complement the popular NIST CSF

Data privacy and cybersecurity have a symbiotic and sometimes conflicting relationship. Without robust cybersecurity, it is impossible to ensure data privacy, as evidenced by the Equifax hack. However, it’s fully possible for an organization to seriously violate users’ data privacy despite practicing robust cybersecurity. To help government agencies and private-sector organizations better manage the risks of collecting and storing user data and bring privacy risk into parity with their broader enterprise risk portfolio, NIST has released a preliminary draft of the new NIST Privacy Framework, with plans to publish an initial completed version by the end of 2019.

The structure of the NIST Privacy Framework closely mirrors that of the popular NIST CSF so that organizations can use the frameworks together. “While managing cybersecurity risk contributes to managing privacy risk,” NIST writes, “it is not sufficient, as privacy risks can also arise outside the scope of cybersecurity risks.” The Cambridge Analytica scandal – which came to light when a former employee blew the whistle, not in the aftermath of a data breach – illustrated this in stark relief.

What’s in the NIST Privacy Framework?

Like the NIST CSF, the NIST Privacy Framework has three components, or tiers, which seek to reinforce privacy risk management by helping organizations connect business and mission drivers with privacy protection activities.

The Core component of the Privacy Framework is a set of increasingly granular activities and outcomes to encourage organizational dialogue about managing privacy risks. It contains five main functions; Identify-P, Govern-P, Control-P, and Communicate-P, are for managing privacy risks related to data processing, and Protect-P relates to managing privacy risks associated with privacy breaches.

Organizations will use the Profiles component of the Privacy Framework to self-assess their current privacy risk management activities or desired outcomes and identify opportunities for improvement by comparing them with a desired target profile. Finally, the Implementation component will help organizations determine whether they have sufficient resources and processes in place to achieve their target profile.

The Privacy Framework is technology-agnostic and “flexible enough to address diverse privacy needs, enable more innovative and effective solutions that can lead to better outcomes for individuals and enterprises, and stay current with technology trends.”

The need for a separate privacy framework

Mobility and connected everything have fundamentally altered the way we live and do business, and consumers now enjoy many conveniences from these technologies. Unfortunately, as the NIST Privacy Framework points out, these conveniences are made possible by data collection on a massive scale, and consumers “may not be able to understand the potential consequences for their privacy as they interact with systems, products, and services.” NIST goes on to say that organizations may not fully understand the consequences, either, and this could have severely negative effects on them in the long run.

Although no federal data privacy law is currently in sight, the California Consumer Privacy Act takes effect on January 1, 2020, and other states are passing privacy legislation modeled on the CCPA. While the NIST Privacy Framework will be voluntary, it seeks to implement some method to the madness and standardize the language around data privacy and privacy risk management.

Public comment on the NIST Privacy Framework draft will be open through October 24, 2019.

The cybersecurity experts at Continuum GRC have deep knowledge of the cybersecurity field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cybersecurity programs.

Continuum GRC is proactive cybersecurity®. Call 1-888-896-6207 to discuss your organization’s cybersecurity needs and find out how we can help your organization protect its systems and ensure compliance.

A robust cyber incident response plan will minimize both damages and recovery time and ensure business continuity.

Proactive measures to defend against data breaches, malware, social engineering, and other cyberattacks are crucial to enterprise cybersecurity, but there’s no such thing as a completely impenetrable system. Despite your best efforts, your company could still be hacked; do you know what to do if that happens? A cyber incident response plan gives organizations a specific set of procedures to follow after a cyberattack, allowing security teams to respond faster and more effectively.

Unfortunately, many organizations either don’t have cyber incident response plans or have ineffective ones that aren’t clear, specific, or current. Here are five tips for developing an effective plan.

Begin with a current risk assessment

One of the most common shortfalls in cyber incident response plans is that they don’t address the specific risks the enterprise faces right now because they are developed using out-of-date or incomplete information. Be sure to conduct a thorough risk assessment before putting a plan together. Because both enterprise data environments and the cyber threat landscape are dynamic, you’ll need to conduct periodic reassessments and adjust your incident response plan accordingly.

Don’t develop your plan in a silo

According to research by McKinsey, incident response plans are often developed in organizational silos, where individual departments or business units prepare plans to mitigate targeted attacks. Unfortunately, this leaves the organization unprepared for an attack that spans multiple business units or even the entire enterprise. Make sure that all company stakeholders work together on incident response, and that the procedures address both types of attacks.

Clearly identify your stakeholders and their roles and responsibilities

Depending on an organization’s size, quite a few people can be involved in cyber incident response, from IT and security staff to legal and public relations personnel. Who is the incident commander? Who has the authority to take systems offline? Who notifies victims in the event of a breach, and how? Who handles press inquiries? Make sure that your plan specifies who is involved and what their responsibilities are.

Clearly define incident types and thresholds

Different types of attacks require different countermeasures. A high-risk or critical incident might warrant the full or partial shutdown of a system, but doing this would be overkill for a low-risk incident. Incident response plans should include a quantifiable method to classify cyber incidents according to severity.

Outline clear, specific procedures

Each incident classification category must be attached to clear, specific procedures outlining, in detail, what each stakeholder needs to do as part of the incident response. This includes internal reporting and documentation, investigation, containment and eradication, and recovery. Make sure the procedures outline when external parties, such as law enforcement, government regulators, outside legal counsel, and cyber insurers, need to be involved.

Developing a comprehensive cyber incident response plan is well worth the time and effort to minimize damages and ensure business continuity. According to the Ponemon Institute, companies that contain data breaches within 30 days can save over $1 million in recovery costs.

The cybersecurity experts at Continuum GRC have deep knowledge of the cybersecurity field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cybersecurity programs.

Continuum GRC is proactive cybersecurity®. Call 1-888-896-6207 to discuss your organization’s cybersecurity needs and find out how we can help your organization protect its systems and ensure compliance.